Fix the three protocol numbers the pilot proved wrong

[MongLong0214]

CDEB PRD v1.2 → v1.3. Changes exactly what CDEB-P measured — nothing about the design, the matrix, or the twenty locked decisions.

1. The token threshold knew nothing about the token cost

15% was chosen before anyone measured what the ON arm costs. It costs 45% more.

required S_on/S_off for a 15% reduction = 1.45 / 0.85 = 1.71×
→ at a 50% control rate, ON must reach 85.5%   (+35.5pp)
→ its sibling gate asks for +10pp

Injecting context costs tokens by construction, so the threshold has to know the overhead — and it cannot learn it from the outcomes without becoming a number chosen after the fact.

It now derives from a calibration measured on the §22.4 disposable smoke tasks, which never enter the corpus and therefore expose no outcome:

CalibratedOverhead = T_on / T_off   (on smoke tasks)
RequiredReduction  = max(0.05, 1 - 1 / (CalibratedOverhead × 1.15))

Both go in the freeze manifest before the study runs. No calibration → the gate is NOT MEASURABLE, which beats setting a threshold after seeing results.

2. Three ANDed gates behaved like one

§16.6 required all three. The hardest could veto the other two — a real behaviour improvement would have reported FAIL. That is not a three-metric design; it is a one-metric design that calls itself three.

Token efficiency is still evaluated, still reported, still available as a partial claim under §17.2. It is no longer a necessary condition for the headline. Its threshold is now stricter than the number it replaced — this loosens nothing.

3. "Completable in one session" was a wish with no check

One task in four burned a quarter of the study hitting the 15-minute wall in all four runs.

§4.6 now requires a wall-clock probe at 60% of budget before sealing. The probe may read only wall time and stop reason — never the oracle — the same distinction that let this session read stop_reason mid-study without reading a result. A task that fails is cut or shrunk; the budget is not raised for it, because the budget is a contract with the other 29 tasks.

4. Qualification required the record to exist, not to be reachable

Two tasks in four delivered nothing to the ON arm — ON by assignment, OFF in substance — leaving one task carrying the whole question.

New §4.9: sealing requires that a path the good control edits actually renders the expected record at the frozen snapshot. The good control's file set is the verifiable definition of "what the natural solution touches", rather than the author's expectation. Runs no agent, exposes no outcome.

Also

§9.5 now requires hook_opportunities and delivered_record_ids to be computed separately, with a §25.3 test — the pilot's counter merged them, so a zero could not distinguish "never fired" from "fired on a path with no records". Schemas pin 1.3.x, so a protocol change is a schema change CI notices.

Stated limits

The calibration estimates overhead on work that is not the corpus. And the 0.6 probe budget and the 1.15 factor are judgement calls with no measurement behind them — unlike the three findings that forced this revision. Both are in the commit's Limit: and Warn:.

[github-actions]

CommitLore — record lint

Trailers: clean — 5 commits in origin/dev..6966cb3d178365570b799b4b3f12ae9999b5ddef
Active constraints: 8 limits · 18 ruled-out · 8 warnings — from 8 records over 10 changed paths

Active constraints for the paths this PR touches

Limits (8)

• r-probemodel 6966cb3 — pinning to sonnet means CDEB will say nothing about whether a stronger model needs delivered decisions less, which is a question worth its own study rather than a variable inside this one
• r-runprobe 6a368ec — the gate screens runtime and says so -- completed means the process returned, which a no-op satisfies, and the pilot's 4.9x within-cell spread means two probes cannot bound the tail
• r-delivchk 59ba928 — the runtime probe still has no implementation, so a freeze cannot yet be written even though the schema now demands its evidence
• r-v13fix f4b6859 — schemas and the verifier now require the qualification evidence, but nothing yet produces it -- CDEB-10 must build the probe and the deliverability check before a freeze can be written
• r-cdebv13 e0bd61a — the calibration is measured on disposable tasks, so it estimates overhead on work that is not the corpus and a corpus with different injection density will sit off it
• r-cdebpres e01b482 — one repository, four tasks, six usable runs per arm and a local evaluator -- no claim gate is evaluable and preregistration §8 forbids any number here reaching a public surface
• r-cdebver01 ce7b278 — the schemas freeze protocol 1.2.0 constants -- thresholds, matrix size, category names -- so a protocol change is a schema change and CI notices
• r-cdebprd12 c3fefd2 — CDEB measures the shipping trust configuration as it exists, which grades every record claim; a directive-path result requires a different study under a different product digest

Ruled out (18)

• r-probemodel 6966cb3 — qualifying on opus while measuring on sonnet | the gate would screen runtimes the study never produces, and its threshold is derived from sonnet data
• r-probemodel 6966cb3 — leaving the probe model unchecked and documenting the requirement | the mismatch produces timeouts that read as task difficulty, so a note cannot catch what a comparison can
• r-runprobe 6a368ec — averaging the two arms | the study runs six sessions per task, so the slower arm is the one that decides whether they fit, and a mean lets the faster arm carry a task in
• r-runprobe 6a368ec — keeping the probe artifact out of storage | the freeze manifest is required to carry per-task probe results, and a qualification nobody can recheck is not a gate
• r-delivchk 59ba928 — qualifying delivery through commitlore context | budget, trust grading, the guard, lifecycle projection, the matcher and output parsing all sit between it and the agent, and the defect being fixed was zero delivery through exactly those
• r-delivchk 59ba928 — requiring every good-control path to carry every record | a record scoped to one file of a multi-file change still reaches an agent that opens that file, and demanding all of them rejects sound tasks
• r-delivchk 59ba928 — throwing on a non-zero injector exit | the hook is fail-open by design, so the exit code belongs in the freeze manifest where a reader can weigh it
• r-v13fix f4b6859 — keeping the derived threshold with the exponent corrected | any threshold that moves with measured overhead is a threshold the study can influence, and the fixed bar is the only one that means the same thing before and after the run
• r-v13fix f4b6859 — lowering 15% to something the pilot's overhead clears | that measures a different claim and calls it the same one; if 45% overhead makes the bar hard, the bar is reporting a true fact about the product
• r-cdebv13 e0bd61a — raising the 15% to a number that looked achievable | picking a threshold to be clearable is the same act as picking one after seeing results, and only the derivation makes it preregistered
• r-cdebv13 e0bd61a — keeping token efficiency in the conjunction with the new threshold | the objection was never the number, it was that one gate could erase a measured behaviour result while the report called it a three-metric study
• r-cdebv13 e0bd61a — widening the hook matcher so the two silent tasks would deliver | that redefines a delivery failure as a delivery success, and §9.5 exists to record exactly that failure
• r-cdebpres e01b482 — reporting the completed-only table as the pilot's result without the timed-out task | the exclusion is the registered stop_reason rule, and a reader who cannot see that a quarter of the study never finished cannot judge the rest
• r-cdebpres e01b482 — dropping the two zero-delivery tasks as broken | they are the intention-to-treat case the protocol is built around, and they are also how the qualification gap was found
• r-cdebver01 ce7b278 — default-in discovery over the CDEB tree like the legacy gate | that gate's enemy was the unregistered file, CDEB's is the unregistered input, and bench:m5 reads every jsonl in bench/results, so the registered analysis would run over M1, M4 and files marked non-citable #441 showed a glob passing a stopping rule on contamination
• r-cdebver01 ce7b278 — validating with the draft-07 Ajv entry and downgrading the schemas | the 2020-12 entry ships in the same package, and weakening six schemas to fit a meta-schema is backwards
• r-cdebprd12 c3fefd2 — reopening any of the twenty locked decisions in §29 | v1.1 locked them deliberately and every v1.2 change is additive definition, disclosure, or leak-closure
• r-cdebprd12 c3fefd2 — enabling capture in the ON arm for realism | an agent commit mid-run would stage records unattended and change repository state between repeats, destroying the same-history invariant the whole design rests on

Warnings (8)

• r-probemodel 6966cb3 (claim) — a later model change invalidates the 0.6 derivation as well as the pinning, so both must be re-established rather than only the constant edited
• r-runprobe 6a368ec (claim) — runProbe costs two agent sessions per task, so qualifying a 30-task corpus is 60 sessions before a single measured run
• r-delivchk 59ba928 (claim) — delivery qualification proves the record can arrive, not that it will -- an agent that edits another path first or uses a tool outside the matcher still gets nothing, and §9.5 is what records that
• r-v13fix f4b6859 (claim) — the 0.6 probe budget is still a judgement call with no measurement behind it, and it now gates corpus membership through two agent sessions per task
• r-cdebv13 e0bd61a (claim) — the 0.6 probe budget and the 1.15 calibration factor are judgement calls with no measurement behind them, unlike the three findings that forced this revision
• r-cdebpres e01b482 (claim) — the exposure counter counts deliveries rather than opportunities, so a zero cannot distinguish a hook that never fired from one that fired on a path with no records -- CDEB v1 §9.5 requires that split and CDEB-05 must build it
• r-cdebver01 ce7b278 (claim) — every failure fixture is the one valid row with a single mutation, so keep the valid-row builder in lockstep with result.schema.json -- a builder drift fails all eleven cases at once and reads as a broken verifier
• r-cdebprd12 c3fefd2 (claim) — the corpus does not exist yet; nothing in this commit authorises a measured run, which stays behind the freeze gate and Definition of Done

git log --follow accepts exactly one pathspec, so renames are not followed for 10 paths; query one path at a time to follow its rename chain

_{Trailer violations fail this check. Active constraints are informational — they are what the repository already decided, not a verdict on this PR.}